122 lines
4.2 KiB
Markdown
122 lines
4.2 KiB
Markdown
- Help
|
||
- `!mona help assemble`
|
||
- manual : https://www.corelan.be/index.php/2011/07/14/mona-py-the-manual/
|
||
- Update Mona
|
||
- `!mona update`
|
||
- Switch between stable and trunk release:
|
||
- `!mona update -t release`
|
||
- `!mona update -t trunk`
|
||
- Configure working folder
|
||
- `!mona config -set workingfolder c:\mona%p`
|
||
- Global options
|
||
- `-o` - ignore OS module from search operations.
|
||
- `-m` - specify the modules to perform the search operation on (ex: -m "gtk*,*win*,shell32.dll")
|
||
- `-m *` searches all modules
|
||
- `-cm` - set criteria (c) a module (m) should comply with to get included in search operations.
|
||
- Available:
|
||
- aslr
|
||
- rebase
|
||
- safeseh
|
||
- nx
|
||
- os
|
||
- Example of including aslr and rebase modules, but excluding safeseh modules:
|
||
- `-cm aslr=true,rebase=true,safeseh=false`
|
||
- `-cp` - specify what criteria (c) a pointer (p) should match.
|
||
- Available:
|
||
- unicode (also includes unicode transforms)
|
||
- ascii
|
||
- asciiprint
|
||
- upper
|
||
- lower
|
||
- uppernum
|
||
- lowernum
|
||
- numeric
|
||
- alphanum
|
||
- nonull
|
||
- startswithnull
|
||
- Example : only show pointers that contain ascii printable bytes
|
||
- `-cp asciiprint`
|
||
- Example : only show pointers that don’t contain null bytes
|
||
- `-cp nonull`
|
||
- `-cpb` - specify bad characters for pointers, so pointers containing them are skipped
|
||
- Example with null byte, carriage return, and line feet:
|
||
- `-cpb '\x00\x0a\x0d'`
|
||
|
||
- Analyze crash
|
||
- `!mona findmsp`
|
||
- Locate EIP - pattern_create / pattern_offset :
|
||
- `!mona pattern_create 5000`
|
||
- `!mona pattern_offset <EIP_VALUE>`
|
||
- Get value on stack (ascii):
|
||
- `!mona pattern_offset 5Ai6`
|
||
|
||
- Find bad characters:
|
||
- 1 - generate array of all possible characters:
|
||
- `!mona bytearray -cpb "\x00"`
|
||
- 2 - Put array of all hex chars into overflow
|
||
- 3 - run the program until EIP gets overwritten. Then enter the following (0012FD6C is the address of first byte of the badchars array):
|
||
- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
|
||
- 4 - mona gives 1 or multiple badchars. Remove these badchars from array.
|
||
- 5 - repeat above until all bad chars are removed
|
||
- Example:
|
||
- `!mona bytearray -cpb "\x00\x09"`
|
||
- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
|
||
- `!mona bytearray -cpb "\x00\x09\x0a"`
|
||
- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
|
||
- `!mona bytearray -cpb "\x00\x09\x0a\x0d"`
|
||
- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
|
||
|
||
|
||
- SEH
|
||
- Find SEH offset (nseh / seh + jump code):
|
||
- 1 - Replace A's by unique pattern (pattern_create)
|
||
- 2 - `!mona sehchain`
|
||
- Find pop pop ret (for SEH Bypass):
|
||
- `!mona seh`
|
||
- Note: this will create seh.txt in working folder
|
||
|
||
- Egg Hunter:
|
||
- Find eggs occurrences in memory:
|
||
- `!mona find -s "W00TW00T"`
|
||
- Generate egghunter:
|
||
- mona can create an egghunter with checksum check :
|
||
- -t : tag (ex: w00t). Default value is w00t
|
||
- -c : enable checksum routine. Only works in conjunction with parameter -f
|
||
- -f : file containing the shellcode
|
||
- Example:
|
||
- `!mona egg -t W00T`
|
||
- `!mona egg -t W00T -c -f shellcode.bin`
|
||
|
||
- Find jump or call or push/ret to a register:
|
||
- `!mona jmp -r edi`
|
||
- Note: this creates jmp.txt in working folder.
|
||
|
||
|
||
- Find arbitrary instructions in dll:
|
||
- `/usr/share/metasploit-framework/tools/exploit/nasm_shell.rb`
|
||
- `jmp esp ==> FF E4`
|
||
- `!mona modules`
|
||
- `!mona find -s "\xff\xe4" -m <module>`
|
||
|
||
|
||
- Find shellcode occurrences in memory (and integrity check):
|
||
- 1 - Create raw shellcode.bin file using Python or anything you'd like
|
||
- 2 - Search memory for the shellcode with mona:
|
||
- `!mona compare -f C:\Users\administrator\Desktop\WORK\tmp\shellcode.bin`
|
||
|
||
- Asm instructions to opcodes:
|
||
- `!mona assemble -s "xor eax,eax # pop EBX # ret"`
|
||
|
||
- Set breakpoint on addr when the program read or write it:
|
||
- Mandatory arguments:
|
||
- -a
|
||
- -t : where is either “READ” or “WRITE”
|
||
- Note : the address should exist when setting the breakpoint. If not, you’ll get an error.
|
||
- Example : set a breakpoint when the application reads from 0012C431:
|
||
- `!mona bp -a 0x0012C431 -t READ`
|
||
|
||
- Generate msfmodule based on crash:
|
||
- 1 - Replace A's by unique pattern (pattern_create)
|
||
- 2 - When crash occurs:
|
||
- `!mona suggest`
|